toastory
Trust & Verification

Security Policy

Our commitment to code integrity, vulnerability reporting, and safe DOM sanitization.

Supported Versions

We actively support the latest minor release of toastory with security patches and vulnerability remediation.

VersionSupportedNotes
v0.1.xYesActive production release

HTML Sanitization Standards

toastory provides built-in, zero-dependency HTML sanitization for the html option. By default, dangerous tags like <script>, <iframe>, <style>, and unsafe URI protocols (such as javascript:) are stripped from the DOM before mounting.

For applications with strict enterprise security mandates, you can plug in DOMPurify with one line:

import { setSanitizer } from 'toastory';
import DOMPurify from 'dompurify';

setSanitizer((dirty) => DOMPurify.sanitize(dirty));

Reporting a Vulnerability

If you discover a security vulnerability in toastory, please report it privately via GitHub Security Advisories or by emailing our security team directly at security@toastory.dev.

Please include steps to reproduce the issue and allow 48 hours for our maintainers to review and acknowledge the report before public disclosure.